01 · Product name
Maltego
Graph link analysis for people, infrastructure, and documents.
Published by Maltego Technologies.
In short
Maltego is a desktop link-analysis tool. You drop in an entity — a domain, email, person, or phrase — run transforms, and work from the graph that comes back. Maltego CE is the free community edition with limits. Professional and organization licenses are paid. The product is a GUI, not a terminal recon suite.
Product pricing strategy
02
Free and paid
Maltego is free to start and paid when you need more. The free tier is the on-ramp. Volume, locked filters, private scans, or an API are what paid plans usually add. Confirm the current split on the vendor site. This listing does not invent a dollar amount.
Maltego CE is free with limits on results and on commercial use. Maltego Pro and larger deployments are paid. Check the current license on maltego.com before you use it for client work.
Utility and features
03
Maltego, from Maltego Technologies, is what teams open when a pile of leads needs to become a picture. Transforms pull data from public sources and from commercial providers in the Transform Hub. The unit of work is the entity and the edge, which makes it easier to brief than a folder of CSV files.
- Entities and transforms. An entity is a thing on the graph. A transform is a query that takes one entity and returns others. You install transforms from the hub, including ones that call tools you already use.
- Machines. Machines are saved sequences of transforms. They are repeatable workflows, not an AI analyst. Read what each machine asks for before you run it on a real case.
- Editions. CE is free for the community, with return limits. Paid desktop licenses raise the graph size and the commercial terms. Data you buy inside the hub is priced separately.
Community Edition is genuinely useful and genuinely limited: fewer entities returned, and a license that is not a blank check for commercial work. Paid tiers raise those caps and fit into a team. Transforms are only as good as the data source behind them, and many good ones need their own API keys. Maltego does not replace a collector like Amass or Shodan. It is where those results go when the question is “how does this connect?”
- 1
Install Maltego CE and run a transform you understand, such as a domain’s DNS names, on infrastructure you are allowed to examine.
- 2
Keep the first graph small. Delete entities that are only name collisions.
- 3
Add API keys for the transforms you will actually use, and note which edges came from which source.
- 4
Export the graph when it is briefable. Do not treat layout as evidence.
Caveats
04
Maltego CE is free and limited: fewer entities back, and a license that is not a blank check for commercial work. Paid desktop licenses raise those caps. Data sold inside the Transform Hub is priced on its own. Confirm the current license on maltego.com before client work.
Transforms call public sources and commercial APIs. Many useful ones need their own keys. A pretty graph can hide a dead API or a name collision. Maltego does not replace Amass, Shodan, or a breach lookup. It is where those results go when the question is how the leads connect.
Screenshots
05
Potential use cases
06
- Drop in one domain you are allowed to examine and run a DNS transform you can explain. The output is a graph of entities and edges, each of which should still carry the transform that produced it. Pivot a hostname that matters into Amass or Shodan for the collection Maltego did not do. Delete nodes that are only a shared word. Layout is not evidence.
- You already have a mailbox from Have I Been Pwned and a company name from the site. Put both on the graph and run only the transforms whose API keys you configured. You get edges you can point at, plus a pile of name collisions if the company name is common. Pivot the domain to theHarvester or Hunter for addresses that came from a different source. A transform result is a lead from that source, not a confirmed identity.
- When a colleague needs the picture instead of a chat log, export the graph after you have labeled which edges came from public transforms and which came from a paid hub item. The file is a briefing aid. It does not replace the underlying record. Machines are saved sequences, not an analyst. Read what a machine will query before you run it on a real case.
Hard cases
The case where the first result is easy to over-read.
A common name becomes a person
The graph links a company, a LinkedIn-style entity, and three emails because a transform matched a shared surname. Stop. Open each entity, keep the ones whose domain or role you can actually see, and delete the rest before anyone screenshots the layout. Pivot the surviving mailbox through Have I Been Pwned or Holehe. The picture is not an identity until a second selector agrees.
Questions
Is Maltego free?
Maltego CE is free with limits on results and on commercial use. Maltego Pro and larger deployments are paid. Check the current license on maltego.com before you use it for client work.
Does Maltego collect OSINT by itself?
It collects through transforms. Some use public sources. Others call paid APIs. The graph is an organizer and a runner, not a private database of the internet.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Maltego product page
https://www.maltego.com/Pricing
Maltego pricing
https://www.maltego.com/pricing/